RESTEasy’s default exception mapper returns an exception’s localized message in the HTTP 500 response body when an unhandled exception other than a WebApplicationException is not handled by an application exception mapper. A remote unauthenticated attacker who can trigger such an exception can obtain information contained in that message. The disclosed data may include sensitive identifiers, configuration details, or stack trace snippets, which could aid further attacks.

The vulnerability affects multiple Red Hat‑build products that embed RESTEasy, including Red Hat Build of Keycloak, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8 and its Expansion Pack, Red Hat Satellite 6, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, and Red Hat build of Quarkus 3. Version ranges that are affected are currently incomplete and still under confirmation.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available, so the likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that attackers can exploit it from any remote HTTP endpoint that can raise an unhandled exception, without needing authentication, which makes the attack vector straightforward. The impact is limited to information disclosure rather than code execution or service disruption, but the exposed data can be useful for further compromise.